CVE-2026-46147: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() Two bugs exist in…

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() Two bugs exist in the vCPU initialisation path: 1. If a check fails after hyp_pin_shared_mem() succeeds, the cleanup path jumps to 'unlock' without calling unpin_host_vcpu() or unpin_host_sve_state(), permanently leaking pin references on the host vCPU and SVE state pages. Extract a register_hyp_vcpu() helper that performs the checks and the store. When register_hyp_vcpu() returns an error, call unpin_host_vcpu() and unpin_host_sve_state() inline before falling through to the existing 'unlock' label. 2. register_hyp_vcpu() publishes the new vCPU pointer into 'hyp_vm->vcpus[]' with a bare store, allowing a concurrent caller of pkvm_load_hyp_vcpu() to observe a partially initialised vCPU object. Ensure the store uses smp_store_release() and the load uses smp_load_acquire(). While 'vm_table_lock' currently serialises the store and the load, these barriers ensure the reader sees the fully initialised 'hyp_vcpu' object even if there were a lockless path or if the lock's own ordering guarantees were insufficient for nested object initialization.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
linux	linux	< 6.18.30	6.18.30
linux	linux	< 7.0.7	7.0.7
linux	linux	>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 7d3c27b54253cda91dc4d2c1bfc109c490837ab9	7d3c27b54253cda91dc4d2c1bfc109c490837ab9
linux	linux	>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 6d69c0ed978f7f0efd053fc98390f25ab77c1aea	6d69c0ed978f7f0efd053fc98390f25ab77c1aea
linux	linux	>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 73b9c1e5da84cd69b1a86e374e450817cd051371	73b9c1e5da84cd69b1a86e374e450817cd051371
linux	linux_kernel	—	—